ScreenshotNeo
Sign in Get a free key

BlogEngineering

Website Screenshot API Security and Compliance

A practical security review for screenshot APIs: URL validation, browser isolation, credentials, retention, lawful use, compliance evidence, and vendor questions.

By the ScreenshotNeo team1 October 20264 min read

Direct answer: A website screenshot API is a browser-rendering service. It receives a URL or HTML, fetches page resources, executes browser code, and returns an image or PDF. Its security review must therefore cover destination validation and outbound network access, browser isolation, credential handling, output access and retention, and whether you are legally authorized to capture and use the page.

Public documentation can describe technical controls, but it does not prove independent testing, certification, or compliance with your obligations. Request current contracts, assurance reports, data-location commitments, retention schedules, subprocessors, and incident terms before sending confidential or personal data.

What a screenshot API can access

A URL capture request may cause the provider’s browser to resolve DNS, follow redirects, load images, run JavaScript, submit requests, and read content available to that browser session. Treat the URL as an instruction to make outbound network requests, not as harmless text.

  • Destination risk: SSRF can expose private, loopback, link-local, cloud metadata, or reserved addresses if validation is weak.
  • Redirect risk: A public URL can redirect to an internal host, and page JavaScript can request additional destinations.
  • Credential risk: Cookies, authorization headers, or signed URLs may expose private content to the renderer and appear in logs if handled poorly.
  • Output risk: Screenshots can contain source code, customer records, tokens, health data, or other personal information.

Security review checklist

Area Questions to ask Evidence to request
URL and egress Are private, loopback, link-local, and reserved ranges blocked? Are redirects and subrequests rechecked? Which schemes and ports are allowed? Technical documentation, architecture description, penetration-test scope, configuration limits
Browser isolation Does each job receive a fresh context? Are cookies and local storage separated? Are workers unprivileged? Are CPU, memory, and time capped? Isolation design, threat model, independent assurance report
Credentials Are tokens scoped, sent in headers, rotatable, and revocable? Can secrets enter URLs, source code, logs, or screenshots? Authentication documentation, key-management policy, sample redaction configuration
Data lifecycle Are URLs, HTML, images, logs, caches, and generated links retained? Where are they processed? Who can access them? DPA, retention/deletion schedule, subprocessor list, data-location terms
Governance How are incidents reported? Which contract controls apply? Is there an independent audit? Current DPA, assurance report, incident commitments, versioned policies
Authorization Do you own the page or have permission to capture and use it? Do site terms permit automated access? Your authorization record and a documented acceptable-use decision

Destination validation and egress controls

Validate destinations before the browser starts and enforce the same policy during redirects and subrequests. A robust design resolves a hostname, rejects private and reserved address ranges, and protects against DNS rebinding by checking the address used for the actual connection. Restrict schemes to those you need, normally HTTPS, and apply port, redirect-count, response-size, and timeout limits.

Minimal Python URL gate

from ipaddress import ip_address
from urllib.parse import urlparse
import socket

ALLOWED_SCHEMES = {"https"}

def validate_public_url(value: str) -> str:
    parsed = urlparse(value)
    if parsed.scheme not in ALLOWED_SCHEMES or not parsed.hostname:
        raise ValueError("Only HTTPS URLs with a hostname are allowed")
    if parsed.username or parsed.password:
        raise ValueError("Userinfo in URLs is not allowed")
    try:
        addresses = {item[4][0] for item in socket.getaddrinfo(parsed.hostname, 443, type=socket.SOCK_STREAM)}
    except socket.gaierror as exc:
        raise ValueError("DNS resolution failed") from exc
    for address in addresses:
        ip = ip_address(address)
        if not ip.is_global:
            raise ValueError("Destination resolves to a non-public address")
    return parsed.geturl()

print(validate_public_url("https://example.com"))

This is an input check, not a complete SSRF defense. The fetcher must revalidate every redirect and connection, use filtered egress, and prevent access to internal services through alternate protocols or browser features.

Node.js equivalent

import dns from "node:dns/promises";
import net from "node:net";

export async function validatePublicUrl(value) {
  const url = new URL(value);
  if (url.protocol !== "https:" || url.username || url.password) {
    throw new Error("Only credential-free HTTPS URLs are allowed");
  }
  const records = await dns.lookup(url.hostname, { all: true });
  for (const { address } of records) {
    if (net.isIP(address) === 0) throw new Error("Invalid address");
    const first = address.split(".")[0];
    if (address === "127.0.0.1" || address === "::1" || first === "10" || first === "192") {
      throw new Error("Destination is not public");
    }
  }
  return url.href;
}

Production code should use a maintained IP-range library rather than a few hand-written prefixes, and should enforce the policy at the network layer as well as in application code.

Browser isolation and page behavior

Ask whether every render runs in a fresh isolated browser context that is destroyed afterward. Confirm separation of cookies, local storage, cache, service workers, filesystem access, and process privileges. Resource caps should cover navigation time, JavaScript execution, memory, page size, and concurrent jobs.

Isolation must include outbound access. A vendor policy reviewed for this topic describes fresh contexts, an unprivileged container, filtered egress, and checks against private, loopback, link-local, and reserved ranges. Those are vendor disclosures, not independent verification. Ask what was tested, by whom, and when.

Credential handling

Use scoped, short-lived credentials where possible. Send them in an authorization header rather than a query string, because URLs can be copied into browser history, reverse-proxy logs, analytics, referrers, and error reports. Never commit keys to source control.

export SCREENSHOT_API_KEY='replace-me'
# Keep secrets out of shell history and CI logs. Prefer your secret manager.

For authenticated pages, decide whether the provider should receive cookies, an authorization header, or a temporary signed URL. Confirm whether those values are logged, cached, visible to support staff, or included in generated output. Rotate and revoke keys after staff changes, incidents, or suspected exposure.

Output access, retention, and privacy

A screenshot is data. It may contain personal information even when the URL is public, and it can reveal information hidden from search engines. Review storage, logs, caches, backups, download links, sharing controls, geographic processing, and deletion behavior.

One reviewed privacy policy says screenshots are streamed in the response rather than written to the provider's database, object store, or own cache/CDN; it logs only the hostname, creates a fresh browser context per render, and destroys that context after completion. Treat these as that vendor's statements and verify they match your plan and contract.

A different capture workflow reviewed for this topic uploads images to a cloud service and creates a public, unguessable link. Anyone with the link can view, download, copy, and reshare it, and deletion cannot remove copies already downloaded or cached elsewhere. This illustrates why “private screenshot” is not a universal property.

Data-minimisation checklist

  • Capture only the required page, element, viewport, and time period.
  • Redact or remove personal data before capture where practical.
  • Disable caching for confidential pages unless the cache is explicitly controlled.
  • Use short-lived, access-controlled download links.
  • Keep URLs and response bodies out of application logs.
  • Define deletion owners and schedules for screenshots, logs, caches, and backups.

Lawful authorization and acceptable use

Technical access does not create permission. Capture pages you own, pages your customer authorized you to capture, or publicly accessible pages where capture and use are lawful and consistent with site terms. A reviewed acceptable-use policy states that “The API is not a permission slip.” Make an authorization decision before automating collection, especially for authenticated pages, personal data, or content subject to copyright, contract, or access controls.

Compliance questions to put to a provider

  1. Can you provide the current DPA and complete subprocessor list?
  2. Which independent assurance reports are available, and what systems and dates do they cover?
  3. Where are browsers, logs, caches, backups, and support systems located?
  4. What are the exact retention and deletion schedules for URLs, HTML, images, logs, caches, and backups?
  5. How are redirects, DNS changes, browser subrequests, WebSockets, and downloads controlled?
  6. How are API keys scoped, rotated, revoked, and protected from logs?
  7. What incident notification terms apply?
  8. Can authenticated or personal-data-containing pages be processed, and under what contractual restrictions?

CNIL-aligned API practices

CNIL's 2024 security guidance recommends treating API management as part of information-systems security policy and coordinating controls between providers and consumers. Its API guidance supports identifying actors and roles, sending only data strictly necessary for the stated purpose, separating ordinary calls from administrative calls requiring robust authentication, retaining relevant logs to detect misuse, keeping documentation current, avoiding obsolete API versions, and protecting access keys. These are governance practices, not proof that a particular vendor is compliant with your legal obligations.

Using ScreenshotNeo for controlled captures

ScreenshotNeo is a website screenshot API and MCP server. Its clean-shot pipeline accepts consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each step can be disabled. Only clean shots are billed. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads, and cache hits cost nothing, and the response reports the result with X-Page-Verdict and X-Billed headers.

For security-sensitive use, apply your own authorization, destination allowlist, data-minimisation, and retention rules before sending a request. ScreenshotNeo supports custom headers, cookies, user agents, and Authorization, so treat those values as secrets. Its other controls include blocking ads, trackers, requests, or resource types; custom CSS and JavaScript; selector or network-idle waits; caching with a chosen TTL; signed links; asynchronous jobs with signed webhooks; bulk capture of up to 100 URLs per call; and a usage API.

Or skip the browser setup

Use the ScreenshotNeo API documentation for the current request options.

cURL

curl -G "https://api.screenshotneo.com/v1/shot" \
  -d access_key=YOUR_API_KEY \
  --data-urlencode url=https://stripe.com \
  -o shot.webp

Python

import requests

r = requests.get(
    "https://api.screenshotneo.com/v1/shot",
    params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"},
    timeout=90,
)
r.raise_for_status()
open("shot.webp", "wb").write(r.content)

Node.js

const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
if (!res.ok) throw new Error(`Screenshot failed: ${res.status}`);
const fs = await import('node:fs/promises');
await fs.writeFile('shot.webp', Buffer.from(await res.arrayBuffer()));

Cookie banners, popups, and chat widgets are removed before the shot; bot checks, blank pages, and failed loads are never billed; an MCP server lets AI agents take screenshots; 1,000 screenshots a month are free with no card and paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.

Troubleshooting

Symptom Likely cause Fix
Private-address rejection Hostname resolves to a loopback, private, link-local, or reserved range. Use a public, authorized endpoint or a provider with an approved private-network integration; do not bypass the check.
Unexpected internal content Redirect or DNS rebinding bypassed only the initial validation. Recheck every redirect and connection and enforce filtered egress.
401 or 403 Expired, unscoped, revoked, or misplaced credential. Rotate the key, verify required permissions, and send it through the documented header or parameter.
Blank or partial image Page timeout, blocked resource, lazy loading, or insufficient wait. Use a selector, delay, network-idle wait, full-page capture, or resource policy appropriate to the page.
Secret appears in logs Credential was placed in a URL or request logging captured headers. Move it to a secret manager and authorization header; redact logs and rotate the exposed key.
Public image link discovered Output workflow uses bearer links. Use private storage, short expiry, access controls, and a deletion process; verify whether old copies can persist.

Performance, reliability, and cost

  • Performance: Full-page rendering, JavaScript-heavy pages, lazy images, PDFs, and network-idle waits take longer and consume more browser resources than a fixed viewport.
  • Reliability: Use explicit timeouts, bounded retries with jitter, idempotency for asynchronous jobs, and webhook signature verification. Record verdict and billing headers so failed or cached work is distinguishable from successful captures.
  • Cost: Cache stable pages with a deliberate TTL, batch up to 100 URLs when supported, and avoid recapturing unchanged content. Keep retries bounded. With ScreenshotNeo, cache hits and failed loads are not billed, and plans range from 1,000 free shots monthly to paid tiers starting at $5 for 3,000.
  • Operations: Monitor latency, timeout rate, verdicts, response sizes, and provider errors without logging page contents or secrets.

FAQ

Is a screenshot API GDPR compliant?

There is no universal answer. Compliance depends on the provider's processing, your configuration, the data, locations, contracts, and legal basis. Request a DPA and independent evidence, then document your own role allocation and minimisation decisions.

Are screenshots private by default?

No. Some services stream results without storing them; others create shareable links or retain caches. Verify the exact lifecycle for your account and output method.

Can I capture an internal site?

Only when the provider supports it securely and you are authorized. Confirm private-network routing, isolation, credential handling, logging, and contractual restrictions before sending internal data.

Should API keys be placed in the URL?

Prefer scoped authorization headers. Query-string keys can leak through logs, history, referrers, and copied URLs.

Does a public page need authorization?

Public visibility does not settle copyright, contract, privacy, or acceptable-use questions. Confirm that capture and reuse are lawful and consistent with the site's terms.

Keep reading